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IN THE CLAIMS : 

Please amend claims as follows : 
Claims 1-128 are cancelled 

12 9. (New) A method, comprising: 

collecting a plurality of transmission events provided by- 
one or more nodes of a network into one or more data 
structures; and 

creating one or more characterization records for at least 
one data structure of said one or more data structures, one or 
more transmission events of said plurality of the transmission 
events being collected to said at least one data structure of 
said one or more data structures, wherein at least one of said 
one or more characterization records comprises one or more 
indicators of a location or locations of one or more data 
elements comprised in at least one of said one or more 
transmission events, to allow accessing said at least one of the 
one or more characterization records to determine said one or 
more indicators of the location or locations of said one or more 
data elements. 

130. (New) The method of claim 129, wherein said collecting and 
said creating is performed by a site of a plurality of sites 
comprised in said network. 

131. (New) The method of claim 12 9, wherein said one or more 
data elements are stored within said at least one data 
structure . 
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132. (New) The method of claim 129, wherein said collecting 
comprises creating observation records of said plurality of the 
transmission events and storing said observation records in said 
one or more data structures, such that said at least one data 
structure of said one or more data structures comprises one or 
more observation records of said observation records created 
using one or more transmission events of said plurality of the 
transmission events, said one or more observation records being 
generated using one or more characteristics of said one or more 
transmission events in order to allow entering said one or more 
observation records to determine whether at least one of said 
one or more characteristics is present in said at least one data 
structure . 

133. (New) The method of claim 132, wherein said one or more 
characteristics of said one or more transmission events are one 
or more of: a period during which a transmission event of said 
one or more transmission events is occurred, and an internet 
protocol address of a node of said one or more nodes transmitted 
said transmission event . 

134. (New) The method of claim 132, wherein said at least one of 
said one or more characterization records is an index created 
using said one or more observation records. 

135. (New) The method of claim 129, wherein said at least one of 
said one or more characterization records is an index comprising 
one or more of : a type of or an importance level for a 
transmission event of said one or more transmission events of 
said plurality of the transmission events, an internet protocol 
address of a node of said one or more nodes transmitted said 
transmission event, and an internet protocol address of a node 
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of said one or more nodes being a destination of said 
transmission event. 

136. (New) The method of claim 12 9, wherein said at least one of 
said one or more characterization records is an index indicating 
how to enter said at least one of said one or more transmission 
events unabridged. 

137. (New) The method of claim 129, wherein said one or more 
characterization records comprise a summary of said one or more 
transmission events of said plurality of the transmission 
events . 

138. (New) The method of claim 129, wherein at least one of said 
plurality of the transmission events is a notification. 

13 9. (New) The method of claim 12 9, wherein said one or more 
data elements comprise partial or complete data comprised in 
said at least one of the one or more transmission events. 

14 0. (New) The method of claim 12 9, further comprising: 

storing said one or more data structures comprising 
corresponding said one or more characterization records in a 
memory, in a non-volatile memory or in a data storage. 

141. (New) The method of claim 12 9, further comprising: 
storing said one or more data structures with corresponding 

characterization records as a file system or as a hierarchical 
file system. 

142. (New) The method of claim 129, wherein one of said one or 
more characterization records comprise an aggregate summary of 
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said at least one data structure and one or more of other data 
structures of said one or more data structures. 

143. (New) The method of claim 129, wherein said network is 
configured to provide network activity data in a computer system 
comprising a plurality of nodes interconnected for communicating 
via said network. 

144. (New) The method of claim 129, wherein all or selected 
transmission events of said plurality of the transmission events 
are notifications provided by all or selected nodes of said one 
or more nodes of said network. 

145. (New) The method of claim 129, wherein said location or 
said locations of the one or more data elements are in said at 
least one data structure of said one or more data structures. 

146. (New) The method of claim 129, further comprising: 
performing compression of said at least one data structure. 

147. (New) The method of claim 129, further comprising: 
creating a digital signature of said at least one data 

structure . 

148. (New) An apparatus comprising: 

a first controller, configured to perform collecting a 
plurality of transmission events provided by one or more nodes 
of a network into one or more data structures; and 

a second controller, configured to create one or more 
characterization records for at least one data structure of said 
one or more data structures, one or more transmission events of 
said plurality of the transmission events being collected to 
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said at least one data structure of said one or more data 
structures, wherein at least one of said one or more 
characterization records comprises one or more indicators of a 
location or locations of one or more data elements comprised in 
at least one of said one or more transmission events, to allow 
accessing said at least one of the one or more characterization 
records to determine said one or more indicators of the location 
or locations of said one or more data elements. 

149. (New) The apparatus of claim 148, wherein said first 
controller is configured to perform said collecting by creating 
observation records of said plurality of the transmission events 
for storing said observation records in said one or more data 
structures, such that said at least one data structure of said 
one or more data structures comprises one or more observation 
records of said observation records created using one or more 
transmission events of said plurality of the transmission 
events, said one or more observation records being generated 
using one or more characteristics of said one or more 
transmission events in order to allow entering said one or more 
observation records to determine whether at least one of said 
one or more characteristics is present in said at least one data 
structure . 

150. (New) The apparatus of claim 149, further comprising: 
a memory, configured to store said one or more data 

structures and to store, for said at least one of said one or 
more data structures, said one or more observation records and 
said one or more characterization records. 

151. (New) The apparatus of claim 149, wherein said one or more 
characteristics of said one or more transmission events are one 
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or more of: a period during which a transmission event of said 
one or more transmission events is occurred, an internet 
protocol address of a node of said one or more nodes transmitted 
said transmission event. 

152. (New) The apparatus of claim 149, wherein said at least one 
of said one or more characterization records is an index created 
using said one or more observation records. 

153. (New) The apparatus of claim 148, further comprising: 
a memory, configured to store said one or more data 

structures comprising corresponding said one or more 
characterization records. 

154. (New) The apparatus of claim 151, wherein said memory is a 
non-volatile memory or a data storage. 

155. (New) The apparatus of claim 151, wherein said one or more 

data structures with corresponding characterization records are 
stored as a file system or as a hierarchical file system. 

156. (New) The apparatus of claim 148, wherein said location or 
said locations of the one or more data elements are in said at 
least one data structure of said one or more data structures. 

157. (New) The apparatus of claim 148, wherein said one or more 
data elements are stored within said at least one data 
structure . 

158. (New) The apparatus of claim 148, wherein said at least one 

of said one or more characterization records is an index 
comprising one or more of : a type of or an importance level for 
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a transmission event of said one or more transmission events of 
said plurality of the transmission events, an internet protocol 
address of a node of said one or more nodes transmitted said 
transmission event, and an internet protocol address of a node 
of said one or more nodes being a destination of said 
transmission event. 

159 

• . (New) The apparatus of claim 148, wherein said at least one 
of said one or more characterization records is an index 
indicating how to enter said at least one of said one or more 
transmission events unabridged. 

160. . (New) The apparatus of claim 148, wherein said one or more 
characterization records comprise a summary of said one or more 
transmission events of said plurality of the transmission 
events . 

161. MSl. (New) The apparatus of claim 148, wherein at least one of 
said plurality of the transmission events is a notification. 

162. . (New) The apparatus of claim 148, wherein said one or more 
data elements comprise partial or complete data comprised in 
said at least one of the one or more transmission events. 

163. d}^&2x (New) The apparatus of claim 148, wherein one of said one 
or more characterization records comprise an aggregate summary 
of said at least one data structure and one or more of other 
data structures of said one or more data structures. 

164. (New) The apparatus of claim 148, wherein all or selected 

transmission events of said plurality of the transmission events 
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are notifications provided by all or selected nodes of said one 
or more nodes of said network. 

165. >&fi4x. (New) The apparatus of claim 148, wherein said location or 
said locations of the one or more data elements are in said at 
least one data structure of said one or more data structures. 

166. x|?gjgx. (New) A computer software product, comprising a computer- 
usable medium having computer readable instructions stored 
thereon for execution by a processor to perform a method 
comprising : 

collecting a plurality of transmission events provided by 
one or more nodes of a network into one or more data 
structures; and 

creating one or more characterization records for at least 
one data structure of said one or more data structures, one or 
more transmission events of said plurality of the transmission 
events being collected to said at least one data structure of 
said one or more data structures, wherein at least one of said 
one or more characterization records comprises one or more 
indicators of a location or locations of one or more data 
elements comprised in at least one of said one or more 
transmission events, to allow accessing said at least one of the 
one or more characterization records to determine said one or 
more indicators of the location or locations of said one or more 
data elements. 

16 7. DBQOi (New) The computer software product of claim 164, wherein 
said one or more data elements are stored within said at least 
one data structure. 
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Mfec. (New) The computer software product of claim 164, wherein 
said collecting comprises creating observation records of said 
plurality of the transmission events and storing said 
observation records in said one or more data structures, such 
that said at least one data structure of said one or more data 
structures comprises one or more observation records of said 
observation records created using one or more transmission 
events of said plurality of the transmission events, said one 
or more observation records being generated using one or more 
characteristics of said one or more transmission events in order 
to allow entering said one or more observation records to 
determine whether at least one of said one or more 
characteristics is present in said at least one data structure. 

xkgx6(. (New) The computer software product of claim 166, wherein 
said one or more characteristics of said one or more 
transmission events are one or more of : a period during which a 
transmission event of said one or more transmission events is 
occurred, and an internet protocol address of a node of said one 
or more nodes transmitted said transmission event. 

XkSScx (New) The computer software product of claim 166, wherein 
said at least one of said one or more characterization records 
is an index created using said one or more observation records. 

xkg^. (New) The computer software product of claim 164, wherein 
said at least one of said one or more characterization records 

is an index comprising one or more of: a type of or an 
importance level for a transmission event of said one or more 
transmission events of said plurality of the transmission 
events, an internet protocol address of a node of said one or 
more nodes transmitted said transmission event, and an internet 
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protocol address of a node of said one or more nodes being a 
destination of said transmission event. 

172. qx^e . (New) The computer software product of claim 164, wherein 
said at least one of said one or more characterization records 
is an index indicating how to enter said at least one of said 
one or more transmission events unabridged. 

173. ma. (New) The computer software product of claim 164, wherein 
said one or more characterization records comprise a summary of 
said one or more transmission events of said plurality of the 

t ransmi s s i on event s . 

53^X2. (New) The computer software product of claim 164, wherein 
at least one of said plurality of the transmission events is a 
notification. 

.75. xiaa. (New) The computer software product of claim 164, wherein 

said one or more data elements comprise partial or complete data 
comprised in said at least one of the one or more transmission 
events . 

176. xMA. (New) The computer software product of claim 164, wherein 
said method further comprises: 

storing said one or more data structures comprising 
corresponding said one or more characterization records in a 
memory, in a non-volatile memory or in a data storage. 

177. xkxfe. (New) The computer software product of claim 164, wherein 
said method further comprises: 
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Storing said one or more data structures with corresponding 
characterization records as a file system or as a hierarchical 
file system. 

W^'^W. (New) The computer software product of claim 164, wherein 
one of said one or more characterization records comprise an 
aggregate summary of said at least one data structure and one or 
more of other data structures of said one or more data 
structures . 

xiMkx (New) The computer software product of claim 164, wherein 
all or selected transmission events of said plurality of the 
transmission events are notifications provided by all or 
selected nodes of said one or more nodes of said network. 

ASSx (New) The computer software product of claim 164, wherein 
said location or said locations of the one or more data elements 
are in said at least one data structure of said one or more data 
structures . 

iW. (New) The computer software product of claim 164, wherein 
said method further comprises: 

performing compression of said at least one data structure. 

(New) The computer software product of claim 164, wherein 

said method further comprises: 

creating a digital signature of said at least one data 
structure . 
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